Connect Okta, Active Directory, your HR system, and other systems for CMMC
Machines cannot prove that someone who left lost their access, that every account signs in with multifactor, or that people were trained. Those answers live in your identity, HR, and training systems. Gardience can read them, read only, and show what it finds as evidence on Security > CMMC Level 2, next to the checks on your machines, checked again every day.
Open Security > CMMC Level 2 > Other systems. Each system is connected with an API key that only reads. Keys are sealed in the vault and sent only to the system they belong to. A system you do not connect is left out of the assessment entirely: nothing counts against you for not using it.
Okta
| Check | Requirement | Passes when |
|---|---|---|
| OKTA-01 Every active user is enrolled in multifactor sign-in | 3.5.3 | Every active user has at least one active factor. A factor still waiting for activation does not count. |
| OKTA-02 Accounts lock after 10 or fewer failed sign-ins | 3.1.8 | Every active password policy locks the account after 10 or fewer failed attempts. |
| OKTA-03 No active account unused for 90 days | 3.5.6 | Every active account older than 90 days signed in within the last 90 days. |
| OKTA-04 Four or fewer super administrators | 3.1.5 | Four or fewer users hold the Super Administrator role. |
Connect it: in the Okta Admin Console, sign in as a Read-only Administrator and create a token under Security > API > Tokens. An Okta token can read only what the administrator who created it can, so a read-only administrator's token cannot change anything. Enter your Okta domain (for example acme.okta.com, or your Okta for Government domain) and the token. When Okta asks where API calls with the token may come from, choose In any of the following zones and add a zone with your Gardience server's outbound address, so the token is useless anywhere else.
Active Directory
| Check | Requirement | Passes when |
|---|---|---|
| AD-01 Domain passwords need 14 or more characters with complexity | 3.5.7 | The domain's password policy (Default Domain Policy) sets a minimum of 14 characters and complexity. Fine-grained password policies are not read. |
| AD-02 Domain password history remembers 24 or more passwords | 3.5.8 | The domain remembers 24 or more passwords. |
| AD-03 Domain accounts lock after 10 or fewer failed sign-ins | 3.1.8 | The domain locks an account after 1 to 10 failed attempts. |
| AD-04 No enabled domain account unused for 90 days | 3.5.6 | Every enabled person older than 90 days signed in within the last 90 days. |
| AD-05 Four or fewer people are domain administrators | 3.1.5 | Four or fewer enabled people are in Domain Admins, Enterprise Admins, or Administrators, nested groups included. |
The enabled accounts are also checked against your termination report (below), next to Okta and Microsoft 365.
Connect it: Gardience reads Active Directory over LDAPS (port 636) with an ordinary domain account: it needs no administrator rights and changes nothing. Create an account such as svc-gardience, then enter:
- Domain controller: its full name as its certificate shows it, for example
dc01.acme.local. The certificate is checked against this name. - Address: only if that name does not resolve from the Gardience server, the domain controller's IP address.
- Account (for example
svc-gardience@acme.local) and its password, sealed in the vault. - Your certificate authority's certificate (PEM). LDAPS needs a certificate on the domain controller: Active Directory Certificate Services issues one automatically. Export your CA's certificate (
certutil -ca.cert ca.cer, then open it and copy it as Base-64) and paste it here.
Gardience never sends the password without TLS. A connection without a trusted certificate, or with a certificate for another name, is refused before anything is saved. Tested against a real Windows Server 2022 domain.
Any other system
Most HR, payroll, badge, training, and ticket systems can publish a report as a CSV file at an HTTPS address: a scheduled report link, or a shared file link. Add it under Any other system, choose which proof record it is (for example Background checks before access or Visitor log), and add a bearer token if the address needs one. Gardience fetches it now and every day and keeps it as that record, so the record stays current and nobody is asked for it.
The address must use HTTPS, and Gardience refuses addresses on its own network, loopback, link-local, or a cloud metadata service. A report must have a header line and at least one row, and be 5 MB or less. Cells that would start a spreadsheet formula are kept as text.
People who left: a termination report from any HR or payroll system
Add your HR or payroll system's terminated-employees report (ADP, Paychex, Gusto, Paylocity, and most others can schedule one) and choose Termination and transfer checklists. Besides keeping the report as that record, Gardience reads it as a list of people who left:
| Check | Requirement | Passes when |
|---|---|---|
| HR-01 Everyone who left in the last 90 days has no enabled account | 3.9.2 | No one whose date left falls in the last 90 days still has an enabled account in Okta, Microsoft 365, or the Gardience console. |
The report needs a header line with an email column (for example "Work email") and a date-left column (for example "Termination date", "Last day of work", or "Separation date"). Dates like 2026-10-20, 10/20/2026, and Oct 20, 2026 are read. The comparison needs at least one identity system that Gardience has read: Okta or Microsoft 365. Without one, the check shows as unknown, not passed. A report without those columns is kept as the record only. Equipment and badge returns stay on the checklist for your team to confirm.
Connectors for KnowBe4 training records and BambooHR are in preview and shown only after they are verified against a live account. Meanwhile, a training completion report from your training system, kept as the Security awareness training records, keeps that record current the same way.
Keep the score in sync
By default a person records each requirement's status, and Gardience suggests which ones its evidence supports. With Keep the score in sync with the evidence turned on (at the top of the Other systems window, admins only):
- A requirement whose evidence is complete is recorded as met on its own: the six requirements Gardience covers fully from your machines.
- A requirement recorded that way goes back to not met when its evidence fails, with a plan of action that names what failed and a milestone 30 days out.
- A status a person recorded is never changed. Requirements with only partial evidence are never marked met automatically: a person confirms the rest.
- Every change is in the audit log, by the system that caused it (for example "Okta (automatic)").
Turning it on applies it at once; turning it off leaves every status as it is.
Checks and failures
Every connected system is checked when it is connected, when you choose Check now, and once a day. If a system cannot be read (an expired token, a removed key, a service that is down), its last results stay in place, the window shows the error, and the console's health banner says which system to check. Disconnect deletes the saved key and takes the system's checks out of the assessment; nothing in the system itself is changed.
See also: Connect Microsoft 365 for CMMC and CMMC Level 2.